MCP server bridge for APC Auto Spa booking and service management API
Five tools with explicit schemas and descriptions, but significant gaps in parameter documentation and output schema clarity. Tool names follow verb_noun convention (list_, check_, register_, create_, get_) which is good. However, most parameters lack descriptions, e.g., location_id, service_ids, requested_date in check_availability have no descriptions explaining format, constraints, or when they're optional. Output schemas are not documented anywhere; responses are returned as raw JSON text without structure hints. Error handling is minimal, no recovery guidance or actionable error messages. The register_agent tool exposes a critical security concern: the returned api_key is shown only once but the description doesn't warn agents to store it securely or explain the irreversible nature of this operation.
Check available appointment slots by date and service. No auth required.
Submit a booking request on behalf of a user. AGENT10 discount (10% off) applied at checkout. Requires APC_API_KEY.
Check booking status by public job ID. Requires APC_API_KEY.
Browse APC Auto Spa service catalog with base and agent-discounted prices. No auth required.
Self-register an API key. Call once and store the returned api_key — shown only once.
Parameters lack descriptions. check_availability has location_id, service_ids, requested_date with no descriptions explaining format (e.g., is location_id 'tukwila' or a UUID?), constraints, or optionality. create_lead vehicle object properties (year, make, model) are undescribed. LLMs cannot infer parameter meaning from names alone.
Output schemas are not documented. Tools return raw JSON text (via content[].text) with no schema hints. LLMs cannot plan downstream calls or extract fields reliably. E.g., list_services returns a 'services' array but structure is unknown to the agent.
register_agent description does not warn that the returned api_key is shown only once and must be stored securely. This is an irreversible operation with critical consequences if the key is lost. Description should explicitly state 'STORE THE RETURNED API_KEY IMMEDIATELY, it will not be shown again.'
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
No error handling guidance. Error responses are raw error messages (e.g., 'APC API error 400: ...') with no recovery hints. LLMs cannot determine if an error is retryable, user-fixable, or fatal. E.g., if check_availability fails, should the agent retry, call register_agent first, or ask the user?
Parameter constraints not documented. check_availability requested_date format is unknown (ISO 8601? 'YYYY-MM-DD'?). create_lead locationPreference description says 'tukwila or monroe' but is not an enum. register_agent agent_id has a pattern description ('Lowercase alphanumeric and hyphens, 3-50 chars') but no enum or regex constraint in the schema.